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Abstract 

Department  of  Defense  (DoD)  systems  are  required  to  be  trusted  and  effective  in  a  wide  range  of  operational  contexts  with  the 
ability  to  respond  to  new  or  changing  conditions  through  modified  tactics,  appropriate  reconfiguration,  or  replacement.  As 
importantly,  these  systems  are  required  to  exhibit  predictable  and  graceful  degradation  outside  their  designed  performance 
envelope.  For  these  systems  to  be  included  in  the  force  structure,  they  need  to  be  manufacturable,  readily  deployable, 
sustainable,  easily  modifiable,  and  cost-effective.  Collectively,  these  requirements  inform  the  definition  of  resilient  DoD  systems. 
This  paper  explores  the  properties  and  tradeoffs  for  engineered  resilient  systems  in  the  military  context,  it  reviews  various 
perspectives  on  resilience,  overlays  DoD  requirements  on  these  perspectives,  and  presents  DoD  challenges  in  realizing  and 
rapidly  fielding  resilient  systems.  This  paper  also  presents  promising  research  themes  that  need  to  be  pursued  by  the  research 
community  to  help  the  DoD  realize  the  vision  of  affordable,  adaptable,  and  effective  systems.  This  paper  concludes  with  a 
discussion  of  specific  DoD  systems  that  can  potentially  benefit  from  resilience  and  stresses  the  need  for  sustaining  a  community 
of  interest  in  this  important  area. 
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l.Background 

The  mission  of  the  United  States  Department  of  Defense  (DoD)  is  to  equip  and  deploy  the  military  forces  needed  to 
deter  war  and  assure  national  security.  To  this  end,  the  DoD  needs  to  maintain  force  readiness,  and  be  able  to  rapidly 
field  required  personnel  and  equipment  to  accomplish  mission  objectives.  The  systems  that  are  deployed  today  and 
will  be  in  the  foreseeable  future  lie  along  a  continuum  from  simple  to  complex.  Examples  of  complex  systems  are 
cyber  infrastructure  systems,  logistical  data  and  information  systems,  and  large-scale  materiel  solutions  such  as 
fixed-wing  aircraft  and  naval  vessels.  In  this  paper,  we  focus  on  the  third  category  (materiel),  noting  that  both  the 
nomenclature  and  reasoning  apply  to  other  systems  as  well.  This  assertion  is  based  on  the  fact  that  all  systems  are 
expected  to  be  trusted  and  effective  in  a  wide  range  of  operational  contexts  with  the  ability  to  respond  to  new 
requirements  through  new  tactics,  appropriate  reconfiguration,  and  timely  replacement. 

Due  to  the  nature  of  the  threats  to  the  Nation  and  its  armed  forces,  the  DoD  will  continue  to  deploy  its  materiel 
throughout  the  world  for  the  foreseeable  future.  This  makes  the  DoD  unlike  any  commercial  enterprise  in  that  its 
mission  remains  relatively  unchanged  for  decades  and  generations  in  the  face  of  unexpected,  unanticipated,  and 
emergent  situations.  This  recognition  provided  the  impetus  for  this  paper. 

Previously,  Neches  et  al.  1  described  resilient  systems  as  follows: 

“A  resilient  system  is  trusted  and  effective  out  of  the  box  in  a  wide  range  of  contexts,  easily  adapted  to  many  others 
through  reconfiguration  or  replacement,  with  graceful  and  detectable  degradation  of  function.  ” 

This  definition  accounts  for  the  fact  that  military  missions  can  range  from  non-kinetic  operations  (e.g.,  Humanitarian 
Assistance  and  Disaster  Relief)  to  kinetic  operations  and  conflict  with,  for  example,  near-peer  states.  Today’s  rapid 
changes  in  missions  and  mission  requirements,  as  well  as  the  emergence  of  new  asymmetric  threats  in  the 
operational  environment,  create  uncertainties  and  surprises  that  have  to  be  dealt  with  on-the-fly.  Furthermore,  ready 
global  access  to  commercial  technology  pose  risks  and  diminish  trust  in  DoD  systems  and  system-of-systems.2,3 

Not  surprisingly,  in  recent  years  there  has  been  a  dramatic  increase  in  interest  within  the  DoD  to  engineer  systems 
that  exhibit  resilience  in  the  face  of  the  unexpected  and  the  unknown.  This  surge  in  interest  is  also  fueled  by  the 
recognition  that  as  systems  continue  to  increase  in  scale  and  complexity,  traditional  fault  protection  approaches  will 
no  longer  suffice  from  both  cost  and  coverage  perspectives.4 

This  paper  is  organized  as  follows.  Section  2  reviews  the  characteristics  of  resilience  from  a  broad  perspective. 
Section  3  presents  a  DoD  perspective  on  the  concept  of  resilience  and  engineered  resilient  systems.  Section  4 
discusses  engineered  resilient  systems  challenges  and  potential  mechanisms  for  introducing  resilience  in  systems. 
Section  5  offers  concluding  comments  including  a  discussion  of  the  future  of  engineered  resilient  systems  in  the 
DoD. 


2.Perspectives  on  Resilience 

Although  resilience  is  rapidly  becoming  a  common  theme  in  a  variety  of  fields,  defining  and  measuring  it  largely 
depends  on  the  problem  domain.  In  October  2013,  a  workshop  co-sponsored  by  the  Military  Operations  Research 
Society  (MORS)  and  Argonne  National  Laboratory  examined  several  analytical  issues  associated  with  enhancing 
societal  and  regional  resiliency13.  The  participants  in  this  workshop  defined  resilience  as  “the  ability  of  an  entity  — 
e.g.,  asset,  organization,  community,  region  —  to  anticipate,  resist,  absorb,  respond  to,  adapt  to,  and  recover  from  a 
disturbance  from  either  natural  or  man-made  events.”  This  definition  is  more  encompassing  than  most  in  that  it 
subsumes  several  resilience  characteristics  included  in  narrower  definitions  of  resilience.  Specifically,  the 
workshop  definition  covers  the  following  key  properties: 
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•  Ability  to  Repel/Resist/ Absorb  Disruptions  (natural  or  manmade) 

o  Ability  of  a  system  to  return  to  its  original  state  or  move  to  a  new,  more  desirable  state  after  being 
disturbed 5 

o  Resilience  in  Ecological  Systems  is  the  measure  of  the  persistence  of  systems  and  of  their  ability 
to  absorb  change  and  disturbance  and  still  maintain  the  same  relationships  between  populations  or 
state  variables  6 

o  Ability  of  a  system  to  achieve  envisioned  (science)  objectives  even  if  the  system  (spacecraft) 
performance,  health,  and/or  environment  are  not  as  expected  7 

o  “Ability  of  a  system  to  circumvent,  survive,  and  recover  from  failures  to  ultimately  achieve 
mission  objectives.  A  resilient  system  is  able  to  reason  about  own/environmental  states  in  the 
presence  of  environmental  uncertainty”. 8 

•  Ability  to  Recover  from  Disruptions  (disasters  or  catastrophic  events) 

o  Ability  of  a  system  to  adjust  its  functioning  prior  to,  during,  or  following  changes  and 
disturbances,  so  that  it  can  sustain  required  operations,  even  after  a  major  mishap  or  in  the 
presence  of  continuous  stress.9 

o  Resilience  in  Social  Ecological  Systems  is  the  capacity  of  a  system  to  absorb  disturbance  and 
reorganize  while  undergoing  change  so  as  to  still  retain  essentially  the  same  function,  structure, 
identity,  and  feedbacks.10 

o  Focus  of  Interest:  The  Resilience  Framework  in  Engineering  —  The  management  of  decision 
making  in  the  trade-off  space  with  respect  to  “disruptions,  system  attributes,  methods,  and 
metrics”.4 

•  Ability  to  Adapt  to  New  or  Changed  Conditions  (man-made  threats  or  natural  disasters) 

o  “Cultural  resilience  refers  to  a  culture's  capacity  to  maintain  and  develop  cultural  identity  and 
critical  cultural  knowledge  and  practices.  Despite  challenges  and  difficulties,  a  resilient  culture  is 
capable  of  maintaining  and  developing  itself.”  11 

While  many  of  these  definitions  are  focused  on  organic  and  ecological  systems,  these  characteristics  also  apply  to 
military  systems.  In  fact,  the  DoD  has  emphasized  the  need  to  improve  the  resiliency  of  both  its  uniformed  and 
civilian  personnel.  Consequently,  the  foregoing  perspectives  on  resilience  offer  a  sound  basis  to  begin  a  meaningful 
discussion  of  resiliency  for  DoD  systems. 

3.The  DoD  Perspective  on  Resilience 

The  DoD  perspective  on  resilience  subsumes  several  earlier  definitions.  However,  the  DoD  is  now  required  to 
engineer  systems  that  exhibit  specific  resilience  properties:  ability  to  Repel/Resist/Absorb;  ability  to  Recover;  and 
ability  to  Adapt.  While  these  characteristics  are  necessary  for  national  defense,  they  are  not  sufficient.  In  addition  to 
these  characteristics,  DoD  systems  are  expected  to  perform  effectively  in  a  wide  range  of  operations  across  multiple 
potential  alternative  futures  despite  experiencing  disruptions.  This  ability  or  property  is  termed  Broad  Utility.12 

In  light  of  the  foregoing,  the  four  key  properties  of  a  resilient  DoD  system  are:  Repel/Resist/Absorb;  Recover; 
Adapt;  and  Broad  Utility  (Figure  1).  In  this  figure,  the  circles  represent  greater  ability  at  the  edges  than  in  the  center 
for  each  resilience  property;  the  intersection  of  two  or  more  circles  can  be  viewed  as  providing  a  reasonably 
effective  resilience  solution.  The  intersection  (i.e.,  nexus)  of  all  four  properties  defines  the  space  of  resilient 
solutions  with  each  solution  in  the  space  being  proximal  to  an  optimal  solution  for  a  particular  property. 
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Figure  1.  Properties  of  Resilient  DoD  Systems  and  System-of-Systems 


Even  under  the  best  of  circumstances,  engineering  a  system  for  resilience  is  a  daunting  task  because  of  the  range  of 
issues  that  need  to  be  addressed.  For  example,  design  envelopes  need  to  be  understood  in  advance,  and  when  a 
system  fails,  it  must  do  so  in  a  predictable,  detectable,  and  graceful  manner  to  enhance  overall  system  survivability 
(i.e.,  survivability  of  both  users  and  the  other  subsystems  in  the  system).  Within  the  DoD,  systems  or  components 
that  are  not  resilient  are  often  labeled  “disposable”  or  “consumable.”  Several  DoD  systems  exhibit  two  or  more  of 
the  properties  shown  in  Figure  1,  making  them  suitable  for  use  in  multiple  operational  environments.  Flowever,  as 
hardware  and  software  technology  allow  for  more  advanced  (i.e.,  sophisticated)  defense  systems,  it  is  almost 
inevitable  that  the  resulting  system  will  be  complex.  As  complexity  increases,  so  does  the  cost  of  these  systems. 
Despite  limited  resources,  scientists  and  acquisition  professionals  are  asked  to  develop  capabilities  that  possess  at 
least  three  if  not  all  four  of  these  properties-  -  -  a  tall  order. 

Some  legacy  military  systems  have  turned  out,  after  the  fact,  to  meet  the  DoD  definition  of  resiliency.  These 
include,  but  are  not  limited  to,  the  Lockheed  C-130  Hercules  air  frame,  Boeing  B-52  Stratofortress,  Ml  13  armoured 
personnel  carrier,  Bradley  Fighting  Vehicle  (BFV),  High  Mobility  Multipurpose  Wheeled  Vehicle  (HMMWV),  and, 
of  course,  Service  Members.  While  none  of  these  systems  are  resilient  in  the  sense  of  Figure  1,  their  range  of 
capabilities,  coupled  with  the  number  of  their  variants/derivatives  and  their  longevity,  lend  credence  to  the  claim 
that  they  exhibit  a  fair  degree  of  resilience.  Furthermore,  each  of  these  systems  satisfies  initial  operational 
requirements,  has  been  in  the  US  inventory  for  over  three  decades,  has  more  than  five  basic  variants,  and  has  the 
capability  to  execute  multiple  missions. 

It  should  be  noted  that  the  HMMWV  has  been  criticized  in  recent  years  for  its  inability  to  repel  enemy  munitions. 
However,  for  its  basic  purpose  as  a  four-wheel  drive,  cargo  carrier,  it  has  been  quite  versatile  at  performing  its  basic 
mission  in  nearly  every  operational  environment  and  weather  condition  encountered  by  US  forces  since  1984.  It  has 
at  least  17  variants  in  service  within  the  U.S.  Military,  and  within  seventy  other  countries.  Its  variants  serve 
numerous  roles  including  cargo/troop  carrier,  automatic  weapons  platform,  ambulance,  missile  carrier, 
howitzer/mortar  prime  mover,  anti-aircraft  platform,  and  communications  shelter. 

Today,  the  DoD  must  use  such  systems  as  the  de  facto  standard  for  resiliency  and  a  point  of  departure  for  enhancing 
the  resilience  of  future  systems  in  accord  with  the  resilience  properties  shown  in  Figure  1.  So,  how  can  the 
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engineering  of  resilient  systems  in  accord  with  Figure  1  be  accomplished?  This  is  the  challenge  that  the  DoD  faces 
today.  Fortunately,  the  materiel  systems  noted  above  could  serve  as  a  baseline  from  which  the  DoD  can  begin  to 
anticipate  and  plan  for  resiliency  for  systems  in  the  acquisition  pipeline.  Flowever,  before  enumerating  the 
engineering  challenges  and  technologies  needed  to  transfonn  the  current  acquisition  process,  it  is  worth  elaborating 
on  the  particulars  of  the  four  key  resilience  properties  for  military  systems.  For  example,  terms  such  as  “lifetime,” 
“environment,”  “disturbance,”  “stress,”  and  “mission,”  take  on  more  specific  meanings  for  DoD  systems. 

Table  1 .  Rationale  for  Resilience  in  DoD  Systems 


•  Lifetime  Operation 

•  Actual  Usage  extends  decades  past  original  plan/design 

•  Regular  planned  and  unplanned  overhauls 

•  Periodic  redesigns  for  service  life  extensions 

•  Changing  operational  and  regulatory  environment 

•  Designed  for  use  in  particular  terrain  and  weather  (e.g.,  desert)  and  used  in  another  (wet) 

•  Ability  to  perform  in  extreme  climates 

•  Accommodate  new  building  construction  techniques  and  materiel 

•  Light  Tactical  Vehicle  adapted  for  use  with  heavy  armor 

•  Shallow  draft  vessel  used  in  deep  ocean 


Of  course,  it  is  well  understood  that  DoD  systems  are  expected  to  perform  a  variety  of  operations  such  as  combat 
operations  and  expeditionary  operations.  However,  the  DoD  has  learned  from  experience  that  the  types  of  operations 
that  a  system  can  potentially  be  employed  in  are,  at  best,  only  partially  predictable.  Table  1  offers  criteria  and 
rationale  for  system  resilience  in  DoD. 

The  types  of  operations  that  a  system  may  be  employed  in  are  rarely  predictable  especially  with  respect  to  the  level 
of  their  employment.  As  the  U.S.  draws  down  operations  in  the  Middle  East  and  reduces  its  military  force  structure, 
it  will  likely  need  to  project  that  force  from  a  limited  number  of  consolidated  bases.  This  requires  a  resilient 
expeditionary  force  that  can  rapidly  deploy,  and  employ  and  sustain  its  capabilities  in  hostile  territories  and/or 
unstable  regimes.  Some  of  the  key  issues  that  affect  the  design  and  development  of  a  DoD  system  operating  in  a 
combat  or  expeditionary  operation  include  but  are  not  limited  to: 

o  Unknown  and  Uncertain  Environments 
o  Mobile  and  Limited  Support  Structure 
o  Extreme  Conditions 
o  Agile  and  Adaptive  Adversary 
o  Changing  Natural/Manmade  Environments 

Many  of  these  systems  are  constrained  by  the  current  DoD  Logistics  System  when  it  comes  to  the  frequency  and 
method  of  resupply.  For  example,  availability  of  mobile  refuelling  platforms  or  limited  varieties  of  fuels  to 
maximise  the  ability  to  support  new  or  unstable  fuel  forms  or  sustain  refuelling  operations  in  an  austere 
environment.  Since  DoD  systems  remain  in  use  for  decades,  they  must  be  designed  and  built  in  a  manner  that 
allows  them  to  be  economically  refurbished  after  extended  use  or  after  use  in  harsh  environments.  For  example, 
wheeled  vehicles  invariably  undergo  major  overhauls  after  returning  from  deployments  to  replace  worn  seals  and 
components  to  extend  their  life  span  within  the  fleet.  To  achieve  longevity,  a  platfonn  must  be  modifiable  and 
upgradeable  during  its  time  within  a  fleet  to  exploit  advances  in  technology,  correct  deficiencies  in  the  system,  and 
replace  components  no  longer  in  the  inventory.  This  provides  a  fleet  or  systems  generating  a  portfolio  of 
capabilities  or  platforms  that  reduce  risk  by  providing  an  array  of  systems  viable  for  mission  requirements  and 
resilient  to  diverse  conditions  8 

Resilience  can  also  be  achieved  by  exploiting  the  loose  coupling  between  micro  systems  whose  interactions  give  rise 
a  complex  macro  capability  that  satisfies  mission  objectives.  For  example,  multiple  self-configuring,  and 
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cooperating  sensors  can  effectively  provide  a  resilient  web  of  data  collectors  by  “swarming.”  The  resulting  macro 
system  would  be  capable  of  adjusting  to  the  changing  environment  and  atmospheric  conditions  based  on  the  micro 
systems  observing  and  communicating  to  a  higher  command  and  control  entity.  Such  systems  have  been  developed 
and  tested  for  tracking  the  movement  of  supplies  through  commercial  and  combat  logistics  systems. 

Defining  a  system  in  this  fashion  also  helps  in  predicting  its  performance  and  projecting  when  it  is  likely  to  need 
maintenance  or  replacement  to  continue  to  deliver  required  capabilities.  The  degradation  function  for  a  system 
provides  insights  in  to  when  a  system  is  no  longer  able  to  operate  in  resilient  fashion  within  the  space  defined  by  the 
intersection  of  its  resilience  properties  (Figure  1). 

4.DoD’s  Resilience  Engineering  Challenges 

In  light  of  the  foregoing,  we  address  the  need  for  engineered  resilient  systems  in  DoD.  To  begin  with,  DoD  systems 
have  to  cope  with  a  wide  range  of  missions  with  high  degrees  of  uncertainty  and  risks.  These  missions  range  from 
non-kinetic  operations  such  as  Humanitarian  Assistance  and  Disaster  Relief  (HA/DR)  to  conflicts  with  near-peer 
states.  Rapid  changes  in  missions,  threats  and  operating  environments  create  uncertainties  in  military  requirements. 
Compounding  the  problems  is  the  fact  that  commercial  technology  is  now  globally  available  to  both  friends  and 
foes.  Dependence  on  global  technology  poses  trustworthiness  risks  for  the  DoD. 

Resilience  in  a  DoD  system  is  the  ability  of  a  family  of  products  to  serve  effectively  in  a  variety  of  missions  with 
multiple  alternative  futures  through  rapid  reconfiguration  or  timely  replacement  despite  uncertainties  about 
individual  component  performance1.  Thus,  as  characterized  by  the  Engineered  Resilient  Systems  (ERS)  program15, 
a  resilient  system  in  DoD:  is  trusted  and  effective  in  a  wide  range  of  mission  contexts;  is  easily  adapted  to  many 
others  through  reconfiguration  and/or  replacement,  and;  has  predictable,  graceful  degradation  of  function14,16. 

A  key  ERS  research  challenge  in  the  DoD  is  to  develop  and  field  “affordably  adaptable  &  effective  systems”  by 
examining  “mission  volatility  and  uncertain  futures”.1,12  The  means  by  which  such  a  capability  can  be  realized  is 
through  a  combination  of  techniques  shown  in  Table  2. 

Table  2.  ERS  Strategies  for  DoD  Systems 


•  Calculating  Leading  Indicators 

-  to  assess  consequences  of  technical/programmatic  decisions  and  controlling  risks 

•  Performing  the  right  trade-offs  in  a  timely  fashion 

-  to  maintain  safety  margins  and  controlling/avoiding  drift 

•  Developing  an  accurate  model  of  drift 

-  to  understand  risk  factors  for  effective  risk  management 

•  Developing  applicable  and  realizable  resilience  heuristics 

-  to  inform  and  guide  resilient  system  design 

•  Developing  appropriate  resilience  metrics 

-  to  evaluate  candidate  resilience  strategies 


Additionally,  the  analysis  of  such  systems  needs  to  be  adaptable  to  the  process  within  which  the  system  operates, 
and  the  products  that  are  being  developed.  This  means  that  there  is  a  need  for  an  adaptive  tradespace  analysis  based 
on  the  purpose  of  the  capability  and  the  missions  in  which  it  is  expected  to  be  used.  Mission  context,  how  a  system 
helps  to  meet  the  desired  end  state  of  an  operation  or  a  series  of  operations  and  still  be  available  for  future 
operations,  must  be  accounted  for  when  designing  a  resilient  platform  that  is  expected  to  provide  the  capability. 
Disposable  systems  are  viable  for  certain  operations;  however,  the  affordability  of  disposable  systems,  or  limited 
supplies  of  complex  systems  in  not  always  possible.  One  must  assess  the  affordability  of  any  system,  disposable  or 
resilient,  to  conduct  a  meaningful  comparison  of  solutions.  This  approach  is  especially  prudent  in  resource- 
constrained  environments. 
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Finally,  cost  analysis  needs  to  be  coupled  to  mission  context  and  grounded  in  physical  reality  and  physics.  The 
complexities  of  the  environments,  cost,  and  the  massive  effects  of  modem  defensive  systems  limit  the  ability  to 
conduct  an  adequate  number  of  real  world  experiments.  Often  this  limits  data  collection  to  that  required  to  validate 
models  and  forecast  likely  performance.  The  use  of  modeling  and  simulations  to  fill  the  massive  tradespace  of 
possible  uses  and  complex  interactions  of  systems  is  essential  in  assessing  the  potential  value  of  a  system.  Today, 
both  industry  and  governments  use  high  performance  computing  assets  with  validated  models  and  simulations  to 
replicate  physics-based  interactions  and  forecast  system  functionality  to  predict  likely  impacts  on  mission  execution 
in  a  variety  of  mission  contexts.  The  data  generated  by  these  models  and  simulations  can  be  assessed  and  the 
resulting  information  can  be  used  to  inform  trades-based  discussions  within  the  DoD.  These  trades  are  used  to 
determine  the  risks  in  a  system’s  ability  to  provide  required  capabilities  as  well  as  to  determine  whether  or  not  a 
system  can  retain  and  exhibit  sufficient  resilience  to  warrant  system  acquisition  and  employment. 

5. Conclusions  and  Recommendations 

The  general  definition  of  resiliency  and  the  particulars  that  constitute  a  resilient  system  depend  somewhat  on  the 
discipline  and  the  framework  employed  for  discussion.  For  the  DoD,  a  slight  variant  of  the  definition  given  in  the 
introduction  still  applies: 

A  resilient  system  is  trusted  and  effective  out  of  the  box,  can  be  used  in  a  wide  range  of  contexts,  is 
easily  adapted  to  many  others  through  reconfiguration  and/or  replacement,  and  has  a  graceful 
and  detectable  degradation  of  function. 

In  practical  terms,  resilient  DoD  systems  need  to  be  able  to  leverage  new  technologies  and  techniques  as  they 
appear,  meet  changing  requirements,  conform  to  new  environments,  and  successfully  meet  the  challenges  of  an 
adaptive  foe.  But,  these  systems  also  need  to  be  manufacturable,  deployable,  sustainable,  modifiable,  and  cost 
effective  to  be  viable  for  inclusion  in  the  force  structure.  Thus,  the  DoD  must  design  its  weapons  systems  to  be 
resilient  at  the  outset.  To  achieve  this  objective,  strategic  DoD  programs  such  as  ERS15  will  continue  to  invest  in 
key  technology  enablers  such  as  tradespace  analysis,  affordability  analysis,  modeling  and  simulation,  and  other 
approaches  to  develop  affordable,  resilient  systems  and  systems-of-systems.  These  approaches  are  key  enablers  for 
the  DoD  to  accomplish  one  of  its  primary  missions,  the  safeguarding  of  national  security  for  this  generation  and 
beyond. 
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